US7310815B2 - Method and apparatus for datastream analysis and blocking - Google Patents

Method and apparatus for datastream analysis and blocking Download PDF

Info

Publication number
US7310815B2
US7310815B2 US10/697,846 US69784603A US7310815B2 US 7310815 B2 US7310815 B2 US 7310815B2 US 69784603 A US69784603 A US 69784603A US 7310815 B2 US7310815 B2 US 7310815B2
Authority
US
United States
Prior art keywords
packet
file
packets
connection
payload
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active, expires
Application number
US10/697,846
Other versions
US20050097358A1 (en
Inventor
Boris Yanovsky
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Micron Technology Inc
Quest Software Inc
Aventail LLC
SonicWall US Holdings Inc
PSM Merger Sub Delaware Inc
Original Assignee
SonicWall LLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Assigned to MICRON TECHNOLOGY, INC. reassignment MICRON TECHNOLOGY, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: RUDECK, PAUL J., POWELL, DON C.
Assigned to SONICWALL, INC. reassignment SONICWALL, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: YANOVSKY, BORIS
Priority to US10/697,846 priority Critical patent/US7310815B2/en
Application filed by SonicWall LLC filed Critical SonicWall LLC
Priority to DE602004005396T priority patent/DE602004005396D1/en
Priority to EP04025579A priority patent/EP1528743B1/en
Priority to AT04025579T priority patent/ATE357803T1/en
Priority to TW093133045A priority patent/TWI378704B/en
Publication of US20050097358A1 publication Critical patent/US20050097358A1/en
Publication of US7310815B2 publication Critical patent/US7310815B2/en
Application granted granted Critical
Assigned to SONICWALL, INC. reassignment SONICWALL, INC. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: PSM MERGER SUB (DELAWARE), INC.
Assigned to PSM MERGER SUB (DELAWARE), INC. reassignment PSM MERGER SUB (DELAWARE), INC. MERGER (SEE DOCUMENT FOR DETAILS). Assignors: SONICWALL, INC.
Assigned to CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH reassignment CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH PATENT SECURITY AGREEMENT (SECOND LIEN) Assignors: AVENTAIL LLC, SONICWALL, INC.
Assigned to CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH reassignment CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH SECURITY AGREEMENT Assignors: AVENTAIL LLC, SONICWALL, INC.
Assigned to AVENTAIL LLC, SONICWALL, INC. reassignment AVENTAIL LLC RELEASE OF SECURITY INTEREST IN PATENTS RECORDED ON REEL/FRAME 024776/0337 Assignors: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH
Assigned to SONICWALL, INC., AVENTAIL LLC reassignment SONICWALL, INC. RELEASE OF SECURITY INTEREST IN PATENTS RECORDED ON REEL/FRAME 024823/0280 Assignors: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH
Assigned to DELL SOFTWARE INC. reassignment DELL SOFTWARE INC. MERGER (SEE DOCUMENT FOR DETAILS). Assignors: SONICWALL L.L.C.
Assigned to SONICWALL L.L.C. reassignment SONICWALL L.L.C. CONVERSION AND NAME CHANGE Assignors: SONICWALL, INC.
Assigned to CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT reassignment CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT SECURITY AGREEMENT Assignors: AVENTAIL LLC, DELL PRODUCTS, L.P., DELL SOFTWARE INC.
Assigned to THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT reassignment THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT SECURITY AGREEMENT Assignors: AVENTAIL LLC, DELL PRODUCTS L.P., DELL SOFTWARE INC.
Assigned to AVENTAIL LLC, DELL SOFTWARE INC., DELL PRODUCTS L.P. reassignment AVENTAIL LLC RELEASE OF SECURITY INTEREST IN CERTAIN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (040039/0642) Assignors: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A.
Assigned to DELL SOFTWARE INC., DELL PRODUCTS, L.P., AVENTAIL LLC reassignment DELL SOFTWARE INC. RELEASE BY SECURED PARTY (SEE DOCUMENT FOR DETAILS). Assignors: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH
Assigned to CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT reassignment CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT FIRST LIEN PATENT SECURITY AGREEMENT Assignors: DELL SOFTWARE INC.
Assigned to CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT reassignment CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT SECOND LIEN PATENT SECURITY AGREEMENT Assignors: DELL SOFTWARE INC.
Assigned to SONICWALL US HOLDINGS, INC. reassignment SONICWALL US HOLDINGS, INC. INTELLECTUAL PROPERTY SECURITY AGREEMENT Assignors: QUEST SOFTWARE INC.
Assigned to SONICWALL US HOLDINGS INC. reassignment SONICWALL US HOLDINGS INC. CORRECTIVE ASSIGNMENT TO CORRECT THE THE NATURE OF CONVEYANCE PREVIOUSLY RECORDED AT REEL: 041073 FRAME: 0001. ASSIGNOR(S) HEREBY CONFIRMS THE INTELLECTUAL PROPERTY ASSIGNMENT.. Assignors: QUEST SOFTWARE INC.
Assigned to AVENTAIL LLC, QUEST SOFTWARE INC. (F/K/A DELL SOFTWARE INC.) reassignment AVENTAIL LLC CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNEE PREVIOUSLY RECORDED AT REEL: 040587 FRAME: 0624. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT. Assignors: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH
Assigned to QUEST SOFTWARE INC. reassignment QUEST SOFTWARE INC. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: DELL SOFTWARE INC.
Assigned to QUEST SOFTWARE INC. (F/K/A DELL SOFTWARE INC.), AVENTAIL LLC reassignment QUEST SOFTWARE INC. (F/K/A DELL SOFTWARE INC.) RELEASE OF FIRST LIEN SECURITY INTEREST IN PATENTS RECORDED AT R/F 040581/0850 Assignors: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT
Assigned to UBS AG, STAMFORD BRANCH, AS COLLATERAL AGENT reassignment UBS AG, STAMFORD BRANCH, AS COLLATERAL AGENT FIRST LIEN PATENT SECURITY AGREEMENT Assignors: SONICWALL US HOLDINGS INC.
Assigned to UBS AG, STAMFORD BRANCH, AS COLLATERAL AGENT reassignment UBS AG, STAMFORD BRANCH, AS COLLATERAL AGENT SECOND LIEN PATENT SECURITY AGREEMENT Assignors: SONICWALL US HOLDINGS INC.
Active legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/02Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281Proxies
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441Countermeasures against malicious traffic
    • H04L63/145Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Definitions

  • the invention relates to the field of computer networks. More specifically, the invention relates to computer network security.
  • FIG. 1 is a diagram illustrating a proxy firewall analyzing packets.
  • an external host 105 establishes a connection 104 to a proxy firewall 103 .
  • the proxy firewall 103 establishes a connection 102 to a protected host 101 on behalf of the external host 105 .
  • the proxy firewall 103 communicates with the protected host 101 on behalf of the external host 105 .
  • the proxy firewall 103 also communicates with the external host 105 on behalf of the protected host 101 .
  • the external host 105 transmits a packet A to the proxy firewall 103 .
  • the proxy firewall 103 receives the packet A and analyzes the packet A at a time 2 .
  • the proxy firewall 103 may analyze the packet's payload, or both the header and the payload. As a proxy, the proxy firewall 103 acts as the protected host 101 and analyzes the packet As payload at the application level. Hence, the proxy firewall 103 must support the application level protocols relevant to packet A. If packet A is determined to be allowed, then at a time 3 . 1 , the packet A is reencapsulated and transmitted to the protected host 101 . If the packet A is determined to be disallowed, then at a time 3 . 2 the packet A is discarded.
  • the proxy firewall is able to analyze the header and the payload of the packet, this technique of analysis is inefficient.
  • the proxy firewall introduces a great amount of latency with the traffic since the proxy firewall is communicating on behalf of the external host and the protected host. Packets are slowed since they are traversing two connections. The latency introduced by the two connections provides the proxy firewall 103 the necessary time to analyze the payload.
  • the proxy firewall 103 must support higher level protocols in order to decapsulate, analyze, and re-encapsulate the packet. Supporting the higher level protocols further increases latency and increases the cost and complexity of the firewall.
  • FIG. 2 is a diagram illustrating packet analysis with a sniffer.
  • an external host 205 establishes a connection 202 to a protected host 201 through a firewall 203 .
  • a packet A is transmitted from the external host 205 .
  • the firewall 203 analyzed the packet A.
  • a sniffer 207 sniffs packets that are transmitted from the external host 205 to the firewall 203 .
  • the sniffer 207 is illustrated as sniffing packets transmitted from the external host 205 to the firewall 203 , the sniffer 207 can also sniff packets transmitted from the firewall 203 to the protected host 201 .
  • the sniffer 207 sniffs the packet A and analyzes the payload of the packet A. As with a proxy firewall, the sniffer 207 must support higher level protocols relevant to the packet A in order to analyze the payload of the packet A. If the packet A is an allowed packet, then the sniffer 207 simply discards the packet A. If the packet A is a disallowed packet, then the sniffer 207 transmits an alarm 209 . The alarm 209 may be transmitted to the firewall 203 , an administrative work station, the protected host 201 , etc.
  • the firewall 203 analyzes packets traversing the connection 202 . Whether the firewall 203 implements packet filtering or stateful packet inspection, the firewall 203 only analyzes the header of the packet A. If the firewall 203 determines that the packet A is allowed, then at a time 3 the firewall 203 forwards the packet A to the protected host 201 . If the firewall 203 determines that the packet A is disallowed, then the packet A is discarded. Unfortunately, the connection 202 remains open even though the packet A is determined to be disallowed. Hence, additional packets can still traverse the connection 202 . Although the firewall 203 discards disallowed packets, disallowed packets may continue to be transmitted on the connection 202 . As long as the connection 202 remains open, the risk of the firewall 203 being penetrated increases.
  • the sniffer technique enables analysis of packet headers and payloads without impacting transmission time by performing packet payload analysis in the sniffer 207 instead of the firewall 203 , the packet payload analysis provided by the sniffer 207 only provides notification and does not prevent infection. By the time the sniffer detects that a packet is disallowed, the packet has already been transmitted to its destination. The sniffer technique provides notification of a threatening connection, but does not block disallowed packets.
  • a network access device analyzes (without proxying) each of a stream of packets traversing a single connection through the network access device from an external host to a protected host.
  • the network access device forwards each allowed packet of the stream of packets as long as the connection is active. However, if one of the stream of packets is determined to be disallowed as a result of the analyzing, then the network access device discards the disallowed packet and terminates the connection, causing the protected host to discard those packets received on the terminated connection.
  • FIG. 1 (Prior Art) is a diagram illustrating a proxy firewall analyzing packets.
  • FIG. 2 (Prior Art) is a diagram illustrating packet analysis with a sniffer.
  • FIG. 3 is an exemplary diagram illustrating datastream packet header analysis according to one embodiment of the invention.
  • FIG. 4 is an exemplary diagram illustrating a network access device performing datastream packet payload block analysis according to one embodiment of the invention.
  • FIG. 5 is an exemplary diagram illustrating a network access device performing datastream packet payload file analysis according to one embodiment of the invention.
  • FIG. 6 is an exemplary diagram illustrating fragmented packet transmission according to one embodiment of the invention.
  • FIG. 7 is an exemplary diagram illustrating retransmission according to one embodiment of the invention.
  • FIG. 8 is an exemplary diagram illustrating throttling according to one embodiment of the invention.
  • FIG. 9 is an exemplary diagram illustrating retransmission according to one embodiment of the invention.
  • FIG. 10 is a diagram illustrating an exemplary network access device according to one embodiment of the invention.
  • FIG. 3 is an exemplary diagram illustrating datastream analysis according to one embodiment of the invention.
  • an external host 303 has established a connection 304 with a protected host 301 .
  • the connection 304 traverses a network access device 305 that supports the connection 304 .
  • the network access device includes a forwarding module 307 and a datastream analysis module 309 .
  • the external host 303 transmits a set of packets 302 A- 302 I along the connection 304 .
  • the datastream analysis module 309 analyzes each of the packets 302 A- 302 E and determines the packet 302 E to be a disallowed packet.
  • the datastream analysis module 309 does not analyze packets 302 F- 302 I after determining packet 302 E to be a disallowed packet.
  • the packets 302 E- 302 I are analyzed as substantially the same time. In such an embodiment, in response to one of the packets 302 E- 302 I being determined as disallowed, analysis of remaining packets is discontinued.
  • the packet 302 E may be disallowed because its header identifies a disallowed source IP address, its payload contains disallowed data, or its payload is the last part of a disallowed file.
  • the analysis may be packet header analysis, packet payload block analysis, packet payload file analysis, or a combination of analysis techniques. With packet header analysis, headers of packets are analyzed. With packet payload block analysis, the payloads of packets are analyzed on a per packet basis. With packet payload file analysis, payloads of packets that form a file are collected and assembled in order for the file to be analyzed. Each of the analysis techniques will be described in more detail below.
  • the forwarding module and the datastream analysis module pass an identifier, pointer, or address to a memory location where a packet is stored
  • the datastream analysis module 309 copies packets to a different memory location.
  • the datastream analysis module 309 indicates to the forwarding module 307 that the packets 302 A- 302 D are allowed.
  • the forwarding module 307 forwards the packets 302 A- 302 D along the connection 304 to the protected host 301 .
  • the network access device 305 discards the packet 302 E.
  • the datastream analysis module 309 discards the packet 302 E.
  • the forwarding module 307 discards the packet 302 E after the datastream analysis module 309 indicates that the packet 302 E is disallowed.
  • the packet 302 E is stored for logging and investigative purposes.
  • the network access device 303 terminates connection 304 . Since the traffic is flowing through the Network Access Device, embodiments of the invention can terminate the traffic in a variety of ways (e.g., simulate each of the devices and send a reset packet to the other device; stop forwarding all the traffic on a particular connection, in order to force each of the devices on either side of the connection to go through the Timeout sequence and shut down the connection; etc.). Since the connection 304 is terminated, the external host 303 must establish a new connection with the protected host 301 in order to send more disallowed packets. Since a connection from the external host 303 has already transmitted disallowed packets, the network access device 305 may deny access to the protected host 301 from the external host 303 .
  • ways e.g., simulate each of the devices and send a reset packet to the other device; stop forwarding all the traffic on a particular connection, in order to force each of the devices on either side of the connection to go through the Timeout sequence and shut down the connection; etc.
  • resources of the network access device 305 will not be spent processing additional disallowed traffic from the external host 303 since the connection 304 has been terminated.
  • the protected host 301 discards the packets 302 A- 302 D since the connection 304 has been terminated.
  • analyzing packets as described in FIG. 3 protects a host without having to establish and maintain two connection as with a proxy firewall. Therefore, datastream analysis can block packet based attacks, provide intrusion detection, provide content filtering and anti-virus protection without introducing the latency of two connections as with a proxy firewall and without expending resources analyzing packets traversing a connection already deemed threatening.
  • the datasteam analysis module can optionally send a notification after the intrusion and/or unauthorized content after blocking an intrusion and/or unauthorized content.
  • FIG. 4 is an exemplary diagram illustrating datastream packet header analysis according to one embodiment of the invention.
  • a connection 402 traverses a network access device 405 that supports the connection 402 .
  • the network access device 405 includes a forwarding module 407 and a datastream analysis module 409 .
  • the datastream analysis module 409 analyzes packets received by the network access device 405 to determine whether packets are allowed or disallowed.
  • the forwarding module 407 receives packets and forwards those packets that the datastream analysis module 409 determines to be allowed. Those packets that are determined to be disallowed by the datastream analysis module 409 are discarded and the connection 402 terminated.
  • the datastream analysis module 409 in FIG. 4 determines whether a packet is allowed or disallowed by using one or more techniques involving the header of a packet.
  • the datastream analysis module 409 inspects headers of packets against a packet filter.
  • a packet filter is a set of rules identifying permitted and/or restricted source addresses. The set of rules may be enhanced with more advanced rules than permitted/restricted source addresses, such as permitted/restricted ports and/or services.
  • the datastream analysis module 409 performs stateful packet inspection.
  • a packet 401 is transmitted along the connection 402 .
  • the datastream analysis module inspects the header of the packet 401 against a set of header rules 421 (e.g., a table for stateful packet inspection, a packet filter, etc.). If the datastream analysis module 409 determines the packet 401 to be an allowed packet, then at a time 3 . 1 the forwarding module 407 forwards the packet 401 along the connection 402 . If the datastream analysis module 409 determines the packet 401 to be a disallowed packet, then at a time 3 . 2 , the packet 401 is discarded and at a time 4 , the threatening connection 402 is terminated.
  • a set of header rules 421 e.g., a table for stateful packet inspection, a packet filter, etc.
  • firewall protection as described in FIG. 4 blocks a threatening connection, thus blocking packet based attacks.
  • providing firewall protection as described in FIG. 4 provides intrusion detection and site restriction without implementing relatively complex and costly proxy services and without introducing latency from multiple connections and processing packets at higher protocols as in proxy firewalls.
  • FIG. 5 is an exemplary diagram illustrating a network access device performing datastream packet payload block analysis according to one embodiment of the invention.
  • a connection 502 traverses a network access device 505 that supports the connection 502 .
  • the network access device 505 includes a forwarding module 507 and a datastream analysis module 509 .
  • the datastream analysis module 509 analyzes packets received by the network access device 505 to determine whether packets are allowed or disallowed.
  • the forwarding module 507 receives packets and forwards those packets that the datastream analysis module 509 determines to be allowed. Those packets that are determined to be disallowed by the datastream analysis module 509 are discarded and the connection 502 terminated.
  • the datastream analysis module 509 in FIG. 5 determines whether a packet is allowed or disallowed by inspecting data in the payload of a packet.
  • a packet 501 is transmitted along the connection 502 .
  • the datastream analysis module inspects the payload of the packet 401 against a set of payload rules 521 (e.g., the payload includes a restricted text string, a restricted URL, threatening script, etc.).
  • a pointer to the payload is provided to the datastream analysis module 509 .
  • the datastream analysis module 509 copies the payload of the packet 501 and can either discard the copied payload whether or not the packet 501 is determined to be allowed or disallowed or store the copy for logging, statistical or other analytical purposes.
  • the forwarding module 507 forwards the packet 501 along the connection 502 . If the datastream analysis module 509 determines the packet 501 to be a disallowed packet, then at a time 3 . 2 the packet 501 is discarded and at a time 4 the threatening connection 502 is terminated.
  • firewall protection as described in FIG. 5 blocks a threatening connection thus blocking packet based attacks.
  • providing firewall protection as described in FIG. 4 provides intrusion detection and site restriction without implementing relatively complex and costly proxy services and without introducing latency from multiple connections and processing packets at higher protocols as in proxy firewalls.
  • the datastream packet payload block analysis described in FIG. 5 enables intrusion detection and content filtering without introducing latency or introducing relatively little latency from analyzing packet payloads in contrast to proxy firewalls.
  • Datastream packet payload block analysis blocks an intrusion and/or unauthorized content and does not allow a packet based intrusion and/or unauthorized content to continue to flow into the network access device, thus avoiding utilization of resources of the network access device analyzing packets of a connection already deemed threatening.
  • FIG. 6 is an exemplary diagram illustrating a network access device performing datastream packet payload file analysis according to one embodiment of the invention.
  • a network access device 605 supports a connection 602 between an external host and a protected host that are not illustrated.
  • the network access device 605 includes a forwarding module 607 and a datastream analysis module 609 .
  • the network access device 605 performs a virus scan prior to the protected host's receipt of an entire file. In one embodiment, with the exception of one or more of the final packets of the stream (the set of one or more hold back packets), the network access device forwards the packets from the stream to the protected host as the stream is received, but the network access device also builds its own copy of the file from the payloads of these packets.
  • the network access device When the set of final packets are received by the network access device, the network access device does not forward the set, but it holds back this set of one or more final packets (also referred to as the set of one or more hold back packets), completes the build of the file, and completes the virus scan (while in certain embodiments the virus scan is not begun until the entire file is built, in other embodiments the virus scan is begun before the entire file is built but is completed after the entire file is built). If a virus is detected, the set of final packets are not sent and the connection is terminated. In response to not receiving the set of final packets, the protected host will discard all of the packets received on the terminated connection; thereby avoiding infection.
  • a last packet 601 is transmitted along the connection 602 .
  • the datastream analysis module 609 copies the payload from the last packet 601 or accesses the payload of the last packet 601 that is stored in memory (e.g., a buffer).
  • the payload of the last packet 601 is assembled with previous packet payloads 623 into a file 631 .
  • the datastream analysis module 609 determines that the last packet 601 is the last packet for the file 631 with any one of a variety of techniques.
  • the datastream analysis module 609 may check the size of the payload, check a sequence number in the header of the last packet 601 , etc.
  • the datastream analysis module 609 analyzes (e.g., performs an anti-virus scan) the file 623 .
  • the forwarding module 607 forwards the last packet 601 along the connection 602 to the protected host. If the file 631 is determined to be threatening, then at a time 5 . 2 , the last packet 601 and the file 631 are discarded. As previously stated, the last packet 601 and the file 631 may be stored for analytical, statistical, or other purposes.
  • Datastream packet payload file analysis provides anti-virus protection that blocks threatening files before they are received by a protected host.
  • the complexities and costliness of managing separate connections for a single datastream as with a proxy firewall is avoided with datastream packet payload file analysis which monitors a single connection for a single datastream
  • the forwarding module 307 and the datastream analysis module 309 may be a single module in the network access device 305 . In such an embodiment, the combined module would wait to forward each packet until analysis had been completed on each packet.
  • packets received at the network access device 305 are queued. While in the queue, the datastream analysis module 309 performs the packet header analysis. The datastream packet header analysis is synchronized so that analysis will complete when a packet advances to an entry in the queue before being forwarded.
  • a connection between an external host and a protected host should be maintained in order to complete datastream payload file analysis.
  • the packet header analysis illustrated in FIG. 4 or the packet payload block analysis illustrated in FIG. 5 may respectively require the connections 402 and 502 to be maintained until analysis has completed.
  • the connection 602 may need to be maintained in order for the file scan to complete.
  • FIGS. 7-9 are diagrams illustrating exemplary techniques that may be performed by a forwarding module for maintaining a connection, but these Figure do not repeat illustration of the analysis illustrated in FIGS. 3-6 .
  • FIG. 7 is an exemplary diagram illustrating throttling according to one embodiment of the invention.
  • An external host 705 transmits a packet 707 A to a protected host 701 through a network access device 703 .
  • the protected host 701 transmits an acknowledgement 709 A to the external host 705 , but the network access device 703 slows down the acknowledgement 709 A as it forwards the acknowledgement 709 A to the external host 705 .
  • the external host 705 transmits a packet 707 B through the network access device 703 to the protected host 701 .
  • the protected host 701 transmits an acknowledgement 709 B to the external host 705 through the network access device 703 .
  • the network access device 703 slows down the acknowledgement 709 B, more than the acknowledgement 709 A, as the network access device forwards the acknowledgement 709 B to the external host 705 .
  • the network access device 703 continues to increase latency of acknowledgements received from the protected host 701 destined for the external host 705 to an amount sufficient for the network access device to 703 to analyze each packet (either packet header analysis or packet payload block analysis) without causing the connection to be closed.
  • FIG. 8 is an exemplary diagram illustrating fragmented packet transmission according to one embodiment of the invention.
  • An external host 805 transmits a packet 807 A through a network access device 803 to a protected host 801 .
  • the protected host 801 transmits an acknowledgement 809 A to the external host 805 through the network access device 803 .
  • the external host 805 attempts to transmit a packet 807 J to the protected host 801 , but the network access device 803 intercepts the packet 807 J.
  • the network access device 803 determines that the packet 807 J is the last packet in the stream as previously described in FIG. 6 .
  • the network access device 803 decapsulates a payload from the packet 807 J, fragments the payload into subparts, and encapsulates each subpart. The network access device 803 then begins to forward each of the encapsulated subparts.
  • the network access device 803 transmits the subpart packet 807 J. 1 to the protected host 801 .
  • the protected host 801 transmits an acknowledgement 809 J. 1 through the network access device 803 to the external host 805 .
  • the acknowledgement 809 J. 1 indicates that it has received a part of the packet 807 J.
  • the external host 805 retransmits the packet 807 J.
  • the network access device 803 transmits a subpart 807 J. 2 to the protected host 801 .
  • the protected host 801 transmits an acknowledgement 809 J. 2 to the external host 805 . This process is repeated until analysis of the packet 807 J or a file assembled from packets 807 A- 807 J has been completed.
  • FIG. 9 is an exemplary diagram illustrating retransmission according to one embodiment of the invention.
  • an external host 905 transmits a packet 907 A to the protected host 901 through the network access device 903 .
  • the network access device 903 copies and forwards the packet 907 A.
  • the protected host 901 transmits an acknowledgement 909 A to the external host 905 .
  • the external host 905 transmits a series of packets after transmitting the packet 907 A and the protected host 901 responds with an acknowledgment for each of the received packets.
  • the external host 905 transmits the packet 907 F to the protected host 901 .
  • the network access device 903 copies and forwards the packet 907 F.
  • the copy of the packet transmitted prior to the packet 907 F is discarded and overwritten by the packet 907 F.
  • An acknowledgement 909 F is transmitted from the protected host 901 to the external host 905 through the network access device 903 .
  • the external host 905 transmits the packet 907 G to the network access device 903 .
  • the network access device 903 determines that the packet 907 G is the last packet (e.g., as previously described in FIG. 6 ) and holds the last packet 907 G.
  • the network access device 903 transmits the packet 907 F (actually a copy of the already transmitted packet 907 F) to the protected host 901 .
  • the protected host 901 transmits an acknowledgement 909 F to the external host 905 again acknowledging receipt of the packet 907 F.
  • the external host 905 transmits the packet 907 G again through the network access device 903 .
  • the network access device 903 retransmits the packet 907 F to the protected host 901 .
  • the protected host 901 transmits the acknowledgement 909 F to the external host 905 , again acknowledging receipt of the packet 907 F.
  • the network access device 903 continues to retransmit the packet 907 F (the next to last packet) until analysis of the packet and/or the file has been completed.
  • FIG. 10 is a diagram illustrating an exemplary network access device according to one embodiment of the invention.
  • a network access device 1001 includes ports 1009 A- 1009 C.
  • the ports 1009 A and 1009 B transmit and receive data to and from protected hosts.
  • the port 1009 C transmits and receives data to and from an external host.
  • the network access device 1001 also includes a memory 1013 that is coupled with the ports 1009 A- 1009 C.
  • the network access device 1001 further includes a forwarding module 1003 and a datastream analysis module 1005 .
  • the forwarding module 1003 is coupled with the datastream analysis module and the memory 1013 .
  • the datastream analysis module is also coupled with the memory 1013 .
  • the hosts and network access devices described in the Figures include memories, processors, and/or ASICs.
  • Such memories include a machine-readable medium on which is stored a set of instructions (i.e., software) embodying any one, or all, of the methodologies described herein.
  • Software can reside, completely or at least partially, within this memory and/or within the processor and/or ASICs.
  • machine-readable medium shall be taken to include any mechanism that provides (i.e., stores and/or transmits) information in a form readable by a machine (e.g., a computer).
  • a machine-readable medium includes read only memory (“ROM”), random access memory (“RAM”), magnetic disk storage media, optical storage media, flash memory devices, electrical, optical, acoustical, or other forms of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.), etc.
  • ROM read only memory
  • RAM random access memory
  • magnetic disk storage media magnetic disk storage media
  • optical storage media flash memory devices
  • electrical, optical, acoustical, or other forms of propagated signals e.g., carrier waves, infrared signals, digital signals, etc.
  • the network access device illustrated in the Figures may be remotely coupled with or directly coupled to a protected host.
  • the operations performed by the network access device are implemented on a machine-readable medium within a protected host.

Abstract

A method and apparatus for datastream analysis and blocking. According to one embodiment of the invention, a network access device, analyzes (without proxying) each of a stream of packets traversing a single connection through the network access device from an external host to a protected host. In addition, the network access device forwards each allowed packet of the stream of packets as long as the connection is active. However, if one of the stream of packets is determined to be disallowed as a result of the analyzing, then the network access device discards the disallowed packet and terminates the connection, causing the protected host to discard those packets received on the terminated connection.

Description

BACKGROUND OF THE INVENTION
1. Field of the Invention
The invention relates to the field of computer networks. More specifically, the invention relates to computer network security.
2. Background of the Invention
FIG. 1 (Prior Art) is a diagram illustrating a proxy firewall analyzing packets. In FIG. 1, an external host 105 establishes a connection 104 to a proxy firewall 103. The proxy firewall 103 establishes a connection 102 to a protected host 101 on behalf of the external host 105. The proxy firewall 103 communicates with the protected host 101 on behalf of the external host 105. The proxy firewall 103 also communicates with the external host 105 on behalf of the protected host 101. At a time 1, the external host 105 transmits a packet A to the proxy firewall 103. The proxy firewall 103 receives the packet A and analyzes the packet A at a time 2. The proxy firewall 103 may analyze the packet's payload, or both the header and the payload. As a proxy, the proxy firewall 103 acts as the protected host 101 and analyzes the packet As payload at the application level. Hence, the proxy firewall 103 must support the application level protocols relevant to packet A. If packet A is determined to be allowed, then at a time 3.1, the packet A is reencapsulated and transmitted to the protected host 101. If the packet A is determined to be disallowed, then at a time 3.2 the packet A is discarded.
Although the proxy firewall is able to analyze the header and the payload of the packet, this technique of analysis is inefficient. In particular, the proxy firewall introduces a great amount of latency with the traffic since the proxy firewall is communicating on behalf of the external host and the protected host. Packets are slowed since they are traversing two connections. The latency introduced by the two connections provides the proxy firewall 103 the necessary time to analyze the payload. In addition, to perform analysis of the payload, the proxy firewall 103 must support higher level protocols in order to decapsulate, analyze, and re-encapsulate the packet. Supporting the higher level protocols further increases latency and increases the cost and complexity of the firewall.
FIG. 2 (Prior Art) is a diagram illustrating packet analysis with a sniffer. In FIG. 2, an external host 205 establishes a connection 202 to a protected host 201 through a firewall 203. At a time 1, a packet A is transmitted from the external host 205. At a time 2, the firewall 203 analyzed the packet A. A sniffer 207 sniffs packets that are transmitted from the external host 205 to the firewall 203. Although the sniffer 207 is illustrated as sniffing packets transmitted from the external host 205 to the firewall 203, the sniffer 207 can also sniff packets transmitted from the firewall 203 to the protected host 201. At a time 2, the sniffer 207 sniffs the packet A and analyzes the payload of the packet A. As with a proxy firewall, the sniffer 207 must support higher level protocols relevant to the packet A in order to analyze the payload of the packet A. If the packet A is an allowed packet, then the sniffer 207 simply discards the packet A. If the packet A is a disallowed packet, then the sniffer 207 transmits an alarm 209. The alarm 209 may be transmitted to the firewall 203, an administrative work station, the protected host 201, etc.
In addition to the protection offered by the sniffer 207, the firewall 203 analyzes packets traversing the connection 202. Whether the firewall 203 implements packet filtering or stateful packet inspection, the firewall 203 only analyzes the header of the packet A. If the firewall 203 determines that the packet A is allowed, then at a time 3 the firewall 203 forwards the packet A to the protected host 201. If the firewall 203 determines that the packet A is disallowed, then the packet A is discarded. Unfortunately, the connection 202 remains open even though the packet A is determined to be disallowed. Hence, additional packets can still traverse the connection 202. Although the firewall 203 discards disallowed packets, disallowed packets may continue to be transmitted on the connection 202. As long as the connection 202 remains open, the risk of the firewall 203 being penetrated increases.
Although the sniffer technique enables analysis of packet headers and payloads without impacting transmission time by performing packet payload analysis in the sniffer 207 instead of the firewall 203, the packet payload analysis provided by the sniffer 207 only provides notification and does not prevent infection. By the time the sniffer detects that a packet is disallowed, the packet has already been transmitted to its destination. The sniffer technique provides notification of a threatening connection, but does not block disallowed packets.
BRIEF SUMMARY OF THE INVENTION
A method and apparatus for datastream analysis and blocking is described. According to one embodiment of the invention, a network access device, analyzes (without proxying) each of a stream of packets traversing a single connection through the network access device from an external host to a protected host. In addition, the network access device forwards each allowed packet of the stream of packets as long as the connection is active. However, if one of the stream of packets is determined to be disallowed as a result of the analyzing, then the network access device discards the disallowed packet and terminates the connection, causing the protected host to discard those packets received on the terminated connection.
These and other aspects of the present invention will be better described with reference to the Detailed Description and the accompanying Figures.
BRIEF DESCRIPTION OF THE DRAWINGS
The invention may best be understood by referring to the following description and accompanying drawings that are used to illustrate embodiments of the invention. In the drawings:
FIG. 1 (Prior Art) is a diagram illustrating a proxy firewall analyzing packets.
FIG. 2 (Prior Art) is a diagram illustrating packet analysis with a sniffer.
FIG. 3 is an exemplary diagram illustrating datastream packet header analysis according to one embodiment of the invention.
FIG. 4 is an exemplary diagram illustrating a network access device performing datastream packet payload block analysis according to one embodiment of the invention.
FIG. 5 is an exemplary diagram illustrating a network access device performing datastream packet payload file analysis according to one embodiment of the invention.
FIG. 6 is an exemplary diagram illustrating fragmented packet transmission according to one embodiment of the invention.
FIG. 7 is an exemplary diagram illustrating retransmission according to one embodiment of the invention.
FIG. 8 is an exemplary diagram illustrating throttling according to one embodiment of the invention.
FIG. 9 is an exemplary diagram illustrating retransmission according to one embodiment of the invention.
FIG. 10 is a diagram illustrating an exemplary network access device according to one embodiment of the invention.
DETAILED DESCRIPTION OF THE INVENTION
In the following description, numerous specific details are set forth to provide a thorough understanding of the invention. However, it is understood that the invention may be practiced without these specific details. In other instances, well-known circuits, structures, standards, and techniques have not been shown in detail in order not to obscure the invention.
FIG. 3 is an exemplary diagram illustrating datastream analysis according to one embodiment of the invention. In FIG. 3, an external host 303 has established a connection 304 with a protected host 301. The connection 304 traverses a network access device 305 that supports the connection 304. The network access device includes a forwarding module 307 and a datastream analysis module 309.
At a time 1, the external host 303 transmits a set of packets 302A-302I along the connection 304. At a time 2, the datastream analysis module 309 analyzes each of the packets 302A-302E and determines the packet 302E to be a disallowed packet. The datastream analysis module 309 does not analyze packets 302F-302I after determining packet 302E to be a disallowed packet. In alternative embodiment of the invention, the packets 302E-302I are analyzed as substantially the same time. In such an embodiment, in response to one of the packets 302E-302I being determined as disallowed, analysis of remaining packets is discontinued. The packet 302E may be disallowed because its header identifies a disallowed source IP address, its payload contains disallowed data, or its payload is the last part of a disallowed file. The analysis may be packet header analysis, packet payload block analysis, packet payload file analysis, or a combination of analysis techniques. With packet header analysis, headers of packets are analyzed. With packet payload block analysis, the payloads of packets are analyzed on a per packet basis. With packet payload file analysis, payloads of packets that form a file are collected and assembled in order for the file to be analyzed. Each of the analysis techniques will be described in more detail below.
While in one embodiment of the invention the forwarding module and the datastream analysis module pass an identifier, pointer, or address to a memory location where a packet is stored, in alternative embodiments of the invention the datastream analysis module 309 copies packets to a different memory location.
At a time 3, the datastream analysis module 309 indicates to the forwarding module 307 that the packets 302A-302D are allowed. At a time 4, the forwarding module 307 forwards the packets 302A-302D along the connection 304 to the protected host 301. At a time 5, the network access device 305 discards the packet 302E. In one embodiment of the invention, the datastream analysis module 309 discards the packet 302E. In alternative embodiments of the invention, the forwarding module 307 discards the packet 302E after the datastream analysis module 309 indicates that the packet 302E is disallowed. In another embodiment of the invention, the packet 302E is stored for logging and investigative purposes.
At a time 6, the network access device 303 terminates connection 304. Since the traffic is flowing through the Network Access Device, embodiments of the invention can terminate the traffic in a variety of ways (e.g., simulate each of the devices and send a reset packet to the other device; stop forwarding all the traffic on a particular connection, in order to force each of the devices on either side of the connection to go through the Timeout sequence and shut down the connection; etc.). Since the connection 304 is terminated, the external host 303 must establish a new connection with the protected host 301 in order to send more disallowed packets. Since a connection from the external host 303 has already transmitted disallowed packets, the network access device 305 may deny access to the protected host 301 from the external host 303. In addition, resources of the network access device 305 will not be spent processing additional disallowed traffic from the external host 303 since the connection 304 has been terminated. At a time 7, the protected host 301 discards the packets 302A-302D since the connection 304 has been terminated.
In addition to preserving performance of the network access device by terminating the connection, analyzing packets as described in FIG. 3 protects a host without having to establish and maintain two connection as with a proxy firewall. Therefore, datastream analysis can block packet based attacks, provide intrusion detection, provide content filtering and anti-virus protection without introducing the latency of two connections as with a proxy firewall and without expending resources analyzing packets traversing a connection already deemed threatening. The datasteam analysis module can optionally send a notification after the intrusion and/or unauthorized content after blocking an intrusion and/or unauthorized content.
FIG. 4 is an exemplary diagram illustrating datastream packet header analysis according to one embodiment of the invention. In FIG. 4, a connection 402 traverses a network access device 405 that supports the connection 402. The network access device 405 includes a forwarding module 407 and a datastream analysis module 409. The datastream analysis module 409 analyzes packets received by the network access device 405 to determine whether packets are allowed or disallowed. The forwarding module 407 receives packets and forwards those packets that the datastream analysis module 409 determines to be allowed. Those packets that are determined to be disallowed by the datastream analysis module 409 are discarded and the connection 402 terminated.
The datastream analysis module 409 in FIG. 4 determines whether a packet is allowed or disallowed by using one or more techniques involving the header of a packet. In one embodiment, the datastream analysis module 409 inspects headers of packets against a packet filter. A packet filter is a set of rules identifying permitted and/or restricted source addresses. The set of rules may be enhanced with more advanced rules than permitted/restricted source addresses, such as permitted/restricted ports and/or services. In another embodiment of the invention, the datastream analysis module 409 performs stateful packet inspection.
In the example illustrated in FIG. 4, at a time 1, a packet 401 is transmitted along the connection 402. Before the forwarding module 407 can forward the packet 401, at a time 2 the datastream analysis module inspects the header of the packet 401 against a set of header rules 421 (e.g., a table for stateful packet inspection, a packet filter, etc.). If the datastream analysis module 409 determines the packet 401 to be an allowed packet, then at a time 3.1 the forwarding module 407 forwards the packet 401 along the connection 402. If the datastream analysis module 409 determines the packet 401 to be a disallowed packet, then at a time 3.2, the packet 401 is discarded and at a time 4, the threatening connection 402 is terminated.
Providing firewall protection as described in FIG. 4 blocks a threatening connection, thus blocking packet based attacks. In addition, providing firewall protection as described in FIG. 4 provides intrusion detection and site restriction without implementing relatively complex and costly proxy services and without introducing latency from multiple connections and processing packets at higher protocols as in proxy firewalls.
FIG. 5 is an exemplary diagram illustrating a network access device performing datastream packet payload block analysis according to one embodiment of the invention. In FIG. 5, a connection 502 traverses a network access device 505 that supports the connection 502. The network access device 505 includes a forwarding module 507 and a datastream analysis module 509. The datastream analysis module 509 analyzes packets received by the network access device 505 to determine whether packets are allowed or disallowed. The forwarding module 507 receives packets and forwards those packets that the datastream analysis module 509 determines to be allowed. Those packets that are determined to be disallowed by the datastream analysis module 509 are discarded and the connection 502 terminated. The datastream analysis module 509 in FIG. 5 determines whether a packet is allowed or disallowed by inspecting data in the payload of a packet.
In the example illustrated in FIG. 5, at a time 1, a packet 501 is transmitted along the connection 502. Before the forwarding module 507 can forward the packet 501, at a time 2, the datastream analysis module inspects the payload of the packet 401 against a set of payload rules 521 (e.g., the payload includes a restricted text string, a restricted URL, threatening script, etc.). Different techniques can be used for the datastream analysis module 509 to inspect the payload of the packet 501. In one embodiment of the invention, a pointer to the payload is provided to the datastream analysis module 509. In another embodiment of the invention, the datastream analysis module 509 copies the payload of the packet 501 and can either discard the copied payload whether or not the packet 501 is determined to be allowed or disallowed or store the copy for logging, statistical or other analytical purposes.
If the datastream analysis module 509 determines the packet 501 to be an allowed packet, then at a time 3.1 the forwarding module 507 forwards the packet 501 along the connection 502. If the datastream analysis module 509 determines the packet 501 to be a disallowed packet, then at a time 3.2 the packet 501 is discarded and at a time 4 the threatening connection 502 is terminated.
Providing firewall protection as described in FIG. 5 blocks a threatening connection thus blocking packet based attacks. In addition, providing firewall protection as described in FIG. 4 provides intrusion detection and site restriction without implementing relatively complex and costly proxy services and without introducing latency from multiple connections and processing packets at higher protocols as in proxy firewalls.
The datastream packet payload block analysis described in FIG. 5 enables intrusion detection and content filtering without introducing latency or introducing relatively little latency from analyzing packet payloads in contrast to proxy firewalls. Datastream packet payload block analysis blocks an intrusion and/or unauthorized content and does not allow a packet based intrusion and/or unauthorized content to continue to flow into the network access device, thus avoiding utilization of resources of the network access device analyzing packets of a connection already deemed threatening.
FIG. 6 is an exemplary diagram illustrating a network access device performing datastream packet payload file analysis according to one embodiment of the invention. In FIG. 6, a network access device 605 supports a connection 602 between an external host and a protected host that are not illustrated. The network access device 605 includes a forwarding module 607 and a datastream analysis module 609.
It is typical for an external host to send to the protected host a stream of packets whose payloads collectively form a file. Unfortunately, such a file may contain a virus that will infect the protected host. In an effort to avoid such an infection, the network access device 605 performs a virus scan prior to the protected host's receipt of an entire file. In one embodiment, with the exception of one or more of the final packets of the stream (the set of one or more hold back packets), the network access device forwards the packets from the stream to the protected host as the stream is received, but the network access device also builds its own copy of the file from the payloads of these packets. When the set of final packets are received by the network access device, the network access device does not forward the set, but it holds back this set of one or more final packets (also referred to as the set of one or more hold back packets), completes the build of the file, and completes the virus scan (while in certain embodiments the virus scan is not begun until the entire file is built, in other embodiments the virus scan is begun before the entire file is built but is completed after the entire file is built). If a virus is detected, the set of final packets are not sent and the connection is terminated. In response to not receiving the set of final packets, the protected host will discard all of the packets received on the terminated connection; thereby avoiding infection.
In the example illustrated in FIG. 6, at a time 1, a last packet 601 is transmitted along the connection 602. At a time 2, the datastream analysis module 609 copies the payload from the last packet 601 or accesses the payload of the last packet 601 that is stored in memory (e.g., a buffer).
At a time 3, the payload of the last packet 601 is assembled with previous packet payloads 623 into a file 631. The datastream analysis module 609 determines that the last packet 601 is the last packet for the file 631 with any one of a variety of techniques. The datastream analysis module 609 may check the size of the payload, check a sequence number in the header of the last packet 601, etc. At a time 4, the datastream analysis module 609 analyzes (e.g., performs an anti-virus scan) the file 623.
If the file 631 is determined to be non-threatening, then at a time 5.1, the forwarding module 607 forwards the last packet 601 along the connection 602 to the protected host. If the file 631 is determined to be threatening, then at a time 5.2, the last packet 601 and the file 631 are discarded. As previously stated, the last packet 601 and the file 631 may be stored for analytical, statistical, or other purposes.
Even though one or more packets of a threatening file are passed to a protected host, the protected host is not infected because it will discard all of the packets received on the terminated connection. Datastream packet payload file analysis provides anti-virus protection that blocks threatening files before they are received by a protected host. In addition, the complexities and costliness of managing separate connections for a single datastream as with a proxy firewall is avoided with datastream packet payload file analysis which monitors a single connection for a single datastream
Although the datastream analysis module and forwarding module are illustrated as separate modules in FIGS. 3-6, various embodiments of the invention may implement the forwarding module and datastream analysis module differently. For example, the forwarding module 307 and the datastream analysis module 309 may be a single module in the network access device 305. In such an embodiment, the combined module would wait to forward each packet until analysis had been completed on each packet. In alternative embodiments of the invention, packets received at the network access device 305 are queued. While in the queue, the datastream analysis module 309 performs the packet header analysis. The datastream packet header analysis is synchronized so that analysis will complete when a packet advances to an entry in the queue before being forwarded.
In certain embodiments of the invention, a connection between an external host and a protected host should be maintained in order to complete datastream payload file analysis. For example, the packet header analysis illustrated in FIG. 4 or the packet payload block analysis illustrated in FIG. 5 may respectively require the connections 402 and 502 to be maintained until analysis has completed. For packet payload file analysis as illustrated in FIG. 6, in addition to the last packet being held to prevent the protected host from assembling a potentially threatening file, the connection 602 may need to be maintained in order for the file scan to complete. FIGS. 7-9 are diagrams illustrating exemplary techniques that may be performed by a forwarding module for maintaining a connection, but these Figure do not repeat illustration of the analysis illustrated in FIGS. 3-6.
FIG. 7 is an exemplary diagram illustrating throttling according to one embodiment of the invention. An external host 705 transmits a packet 707A to a protected host 701 through a network access device 703. The protected host 701 transmits an acknowledgement 709A to the external host 705, but the network access device 703 slows down the acknowledgement 709A as it forwards the acknowledgement 709A to the external host 705. The external host 705 transmits a packet 707B through the network access device 703 to the protected host 701. The protected host 701 transmits an acknowledgement 709B to the external host 705 through the network access device 703. The network access device 703 slows down the acknowledgement 709B, more than the acknowledgement 709A, as the network access device forwards the acknowledgement 709B to the external host 705. The network access device 703 continues to increase latency of acknowledgements received from the protected host 701 destined for the external host 705 to an amount sufficient for the network access device to 703 to analyze each packet (either packet header analysis or packet payload block analysis) without causing the connection to be closed.
FIG. 8 is an exemplary diagram illustrating fragmented packet transmission according to one embodiment of the invention. An external host 805 transmits a packet 807A through a network access device 803 to a protected host 801. The protected host 801 transmits an acknowledgement 809A to the external host 805 through the network access device 803. After a series of packets have been transmitted, the external host 805 attempts to transmit a packet 807J to the protected host 801, but the network access device 803 intercepts the packet 807J. The network access device 803 determines that the packet 807J is the last packet in the stream as previously described in FIG. 6.
The network access device 803 decapsulates a payload from the packet 807J, fragments the payload into subparts, and encapsulates each subpart. The network access device 803 then begins to forward each of the encapsulated subparts. The network access device 803 transmits the subpart packet 807J.1 to the protected host 801. The protected host 801 transmits an acknowledgement 809J.1 through the network access device 803 to the external host 805. The acknowledgement 809J.1 indicates that it has received a part of the packet 807J. In response to the acknowledgement 809J.1, the external host 805 retransmits the packet 807J. The network access device 803 transmits a subpart 807J.2 to the protected host 801. The protected host 801 transmits an acknowledgement 809J.2 to the external host 805. This process is repeated until analysis of the packet 807J or a file assembled from packets 807A-807J has been completed.
FIG. 9 is an exemplary diagram illustrating retransmission according to one embodiment of the invention. In FIG. 9, an external host 905 transmits a packet 907A to the protected host 901 through the network access device 903. The network access device 903 copies and forwards the packet 907A. The protected host 901 transmits an acknowledgement 909A to the external host 905. The external host 905 transmits a series of packets after transmitting the packet 907A and the protected host 901 responds with an acknowledgment for each of the received packets.
The external host 905 transmits the packet 907F to the protected host 901. Once again, the network access device 903 copies and forwards the packet 907F. The copy of the packet transmitted prior to the packet 907F is discarded and overwritten by the packet 907F. An acknowledgement 909F is transmitted from the protected host 901 to the external host 905 through the network access device 903. The external host 905 transmits the packet 907G to the network access device 903. The network access device 903, in FIG. 9, determines that the packet 907G is the last packet (e.g., as previously described in FIG. 6) and holds the last packet 907G. The network access device 903 transmits the packet 907F (actually a copy of the already transmitted packet 907F) to the protected host 901. The protected host 901 transmits an acknowledgement 909F to the external host 905 again acknowledging receipt of the packet 907F.
Since the protected host 901 has indicated that it received the packet 907F, the external host 905 transmits the packet 907G again through the network access device 903. The network access device 903 retransmits the packet 907F to the protected host 901. The protected host 901 transmits the acknowledgement 909F to the external host 905, again acknowledging receipt of the packet 907F. The network access device 903 continues to retransmit the packet 907F (the next to last packet) until analysis of the packet and/or the file has been completed.
FIG. 10 is a diagram illustrating an exemplary network access device according to one embodiment of the invention. In FIG. 10, a network access device 1001 includes ports 1009A-1009C. The ports 1009A and 1009B transmit and receive data to and from protected hosts. The port 1009C transmits and receives data to and from an external host. The network access device 1001 also includes a memory 1013 that is coupled with the ports 1009A-1009C. The network access device 1001 further includes a forwarding module 1003 and a datastream analysis module 1005. The forwarding module 1003 is coupled with the datastream analysis module and the memory 1013. The datastream analysis module is also coupled with the memory 1013.
The hosts and network access devices described in the Figures include memories, processors, and/or ASICs. Such memories include a machine-readable medium on which is stored a set of instructions (i.e., software) embodying any one, or all, of the methodologies described herein. Software can reside, completely or at least partially, within this memory and/or within the processor and/or ASICs. For the purpose of this specification, the term “machine-readable medium” shall be taken to include any mechanism that provides (i.e., stores and/or transmits) information in a form readable by a machine (e.g., a computer). For example, a machine-readable medium includes read only memory (“ROM”), random access memory (“RAM”), magnetic disk storage media, optical storage media, flash memory devices, electrical, optical, acoustical, or other forms of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.), etc.
The network access device illustrated in the Figures may be remotely coupled with or directly coupled to a protected host. In alternative embodiments of the invention, the operations performed by the network access device are implemented on a machine-readable medium within a protected host.
While the invention has been described in terms of several embodiments, those skilled in the art will recognize that the invention is not limited to the embodiments described. The method and apparatus of the invention can be practiced with modification and alteration within the spirit and scope of the appended claims. The description is thus to be regarded as illustrative instead of limiting on the invention.

Claims (44)

1. A method in a network access device comprising:
without proxying, analyzing each of a stream of packets traversing a single connection through the network access device from an external host to a protected host;
forwarding each allowed packet of the stream of packets as long as the connection is active, wherein forwarding each allowed packet comprises transmitting a message indicating that each allowed packet is allowed; and
if one of the stream of packets is determined to be disallowed by said analyzing, then discarding the disallowed packet and terminating the connection, causing the protected host to discard those packets received on the terminated connection.
2. The method of claim 1 wherein analyzing each of the stream of packets comprises inspecting a header of each of the stream of packets against a packet filter.
3. The method of claim 1 wherein analyzing each of the stream of packets comprises inspecting a payload of each of the stream of packets for disallowed content.
4. The method of claim 3 wherein inspecting the payload of each of the stream of packets comprises copying the payload, analyzing the payload, and discarding the corresponding packet if the payload is threatening.
5. The method of claim 1 further comprising:
copying a payload from each of a plurality of packets that comprise a file, the stream of packets including the plurality of packets;
forwarding all but the last of the plurality of packets to the protected host;
reassembling the plurality of packets into the file;
analyzing the file;
if the file is a threatening file then discarding the last packet and terminating the connection; and
if the file is non-threatening, then forwarding the last packet.
6. A computer implemented method comprising:
copying a packet payload of each of a plurality of packets received on a single connection between an external host and a protected host that carries a stream of packets the stream of packets including the plurality of packets;
forwarding all but the last of the plurality of packets to the protected host;
reassembling the copied packet payloads into a file;
analyzing the file to determine if the file is allowed or disallowed;
maintaining the connection while analyzing the file, said maintaining comprising copying each of the plurality of packets but the last packet before forwarding each of the plurality of packets, and
holding the last packet and repeatedly forwarding the last copied packet;
if the file is allowed, then forwarding the last packet to the protected host; and
if the file is determined to be disallowed, then dropping the last packet and terminating the connection.
7. The computer implemented method of claim 6 wherein the analyzing the file comprises performing anti-virus analysis on the file.
8. The computer implemented method of claim 6 further comprising:
analyzing a header of each of the stream of packets; and
if one of the stream of packets is determined to be disallowed, then discarding the disallowed packet and terminating the connection.
9. The computer implemented method of claim 8 wherein analyzing the header comprises inspecting addresses indicated in the header against a packet filter.
10. The computer implemented method of claim 6 further comprising:
individually analyzing each of the copied packet payloads; and
if one of the copied packet payloads is determined to be threatening, then discarding the corresponding packet and terminating the connection.
11. The computer implemented method of claim 10 wherein analyzing each of the copied packet payloads comprises inspecting each copied packet payload against a list of disallowed content and determining if each copied packet payload includes threatening script.
12. The computer implemented method of claim 6, wherein maintaining the connection comprises increasing transmission latency of each acknowledgement transmitted from the protected host to the external host until the analysis is complete.
13. A computer implemented method comprising:
copying a packet payload of each of a plurality of packets received on a single connection between an external host and a protected host that carries a stream of packets the stream of rackets including the plurality of packets;
forwarding all but the last of the plurality of packets to the protected host;
reassembling the copied packet payloads into a file;
analyzing the file to determine if the file is allowed or disallowed;
maintaining the connection while analyzing the file, wherein maintaining the connection comprises:
decapsulating the last packet's payload,
fragmenting the last packet's payload into subparts,
encapsulating each subpart, and
forwarding each subpart until analysis is complete;
if the file is allowed, then forwarding the last packet to the protected host; and
if the file is determined to be disallowed, then dropping the last packet and terminating the connection.
14. A computer implemented method comprising:
copying a packet payload of each of a plurality of packets received on a single connection between an external host and a protected host that carries a stream of packets the stream of packets including the plurality of packets;
forwarding all but the last of the plurality of packets to the protected host;
reassembling the copied packet payloads into a file;
analyzing the file to determine if the file is allowed or disallowed;
if the file is allowed, then forwarding the last packet to the protected host, wherein forwarding each of the plurality of packets comprises transmitting a message indicating that each of the of the plurality of packets is allowed; and
if the file is determined to be disallowed, then dropping the last packet and terminating the connection.
15. A computer implemented method comprising:
supporting a connection from an external host to a protected host;
analyzing a header of each packet received over the connection from the external host;
terminating the connection if a first packet received over the connection is determined to be disallowed and discarding the first packet;
if the connection is not terminated, copying the first packet's payload;
analyzing the first packet's payload;
terminating the connection if said first packet's payload is determined to be disallowed and discarding the first packet;
if the connection has not been terminated and if said first packet's payload is not a last block of a file, then forwarding said first packet to the protected host;
if said first packet's payload is the last block of a file, then reassembling the first packet's payload with a set of one or more previously copied packet payloads into the file;
analyzing the file to determine if the file is allowed or disallowed;
maintaining the connection while analyzing the file, said maintaining comprising copying each of the plurality of packets but the last packet before forwarding each of the plurality of packets, and
holding the last packet and repeatedly forwarding the last copied packet;
if the file is disallowed then dropping the first packet and terminating the connection; and
if the file is allowed then forwarding the first packet.
16. The computer implemented method of claim 15 wherein maintaining the connection comprises increasing transmission latency of each acknowledgement transmitted from the protected host to the external host until the analysis is complete.
17. The computer implemented method of claim 15 wherein the analyzing the file comprises performing anti-virus analysis on the file.
18. The computer implemented method of claim 15 wherein analyzing the header comprises inspecting addresses indicated in the header against a packet filter.
19. The computer implemented method of claim 15, wherein analyzing the first packet's payload comprises inspecting the first packet's payload against a list of disallowed content and determining if the first packet's payload includes threatening script.
20. A computer implemented method comprising:
supporting a connection from an external host to a protected host;
analyzing a header of each packet received over the connection from the external host;
terminating the connection if a first packet received over the connection is determined to be disallowed and discarding the first packet;
if the connection is not terminated, copying the first packet's payload;
analyzing the first packet's payload;
terminating the connection if said first packet's payload is determined to be disallowed and discarding the first packet;
if the connection has not been terminated and if said first packet's payload is not a last block of a file, then forwarding said first packet to the protected host;
if said first packet's payload is the last block of a file, then reassembling the first packet's payload with a set of one or more previously copied packet payloads into the file;
analyzing the file to determine if the file is allowed or disallowed;
maintaining the connection while analyzing the file, wherein maintaining the connection comprises:
decapsulating the last packet's payload,
fragmenting the last packet's payload into subparts,
encapsulating each subpart, and
forwarding each subpart until analysis is complete;
if the file is disallowed then dropping the first packet and terminating the connection; and
if the file is allowed then forwarding the first packet.
21. An apparatus comprising:
a forwarding module to forward packets of a datastream along a connection between a protected host and an external host; and
a datastream analysis module coupled with the forwarding module, the datastream analysis module to analyze each of the packets to determine if each of the packets are allowed or disallowed and to terminate the connection upon determining one of the packets to be disallowed and to discard the disallowed packet, causing the protected host to discard packets received on the terminated connection prior to the disallowed packet, wherein the forwarding module is operable to maintain the connection while the analysis module is analyzing the packets by copying each of the packets but the last packet before forwarding each of the packets, and holding the last packet and repeatedly forwarding the last copied packet.
22. The apparatus of claim 21 further comprising a memory to store each of the packets until forwarded or discarded.
23. The apparatus of claim 21 further comprising a memory coupled with the datastream analysis module, the memory to store copies of each of the packets' payloads.
24. A readable storage medium that provides instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:
without proxying, analyzing each of a stream of packets traversing a single connection through the network access device from an external host to a protected host;
forwarding each allowed packet of the stream of packets as long as the connection is active, wherein forwarding each allowed packet comprises transmitting a message indicating that each allowed packet is allowed; and
if one of the stream of packets is determined to be disallowed by said analyzing, then discarding the disallowed packet and terminating the connection, causing the protected host to discard those packets received on the terminated connection.
25. The readable storage medium of claim 24 wherein analyzing each of the stream of packets comprises inspecting a header of each of the stream of packets against a packet filter.
26. The readable storage medium of claim 24 wherein analyzing each of the stream of packets comprises inspecting a payload of each of the stream of packets for disallowed content.
27. The readable storage medium of claim 26 wherein inspecting the payload of each of the stream of packets comprises copying the payload, analyzing the payload, and discarding the corresponding packet if the payload is threatening.
28. The readable storage medium of claim 24 further comprising:
copying a payload from each of a plurality of packets that comprise a file, the stream of packets including the plurality of packets;
forwarding all but the last of the plurality of packets to the protected host;
reassembling the plurality of packets into the file;
analyzing the file;
if the file is a threatening file then discarding the last packet and terminating the connection; and
if the file is non-threatening, then forwarding the last packet.
29. A readable storage medium that provides instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:
copying a packet payload of each of a plurality of packets received on a single connection between an external host and a protected host that carries a stream of packets the stream of packets including the plurality of packets;
forwarding all but the last of the plurality of packets to the protected host, wherein forwarding each of the plurality of packets comprises transmitting a message indicating that each of the of the plurality of packets is allowed;
reassembling the copied packet payloads into a file;
analyzing the file to determine if the file is allowed or disallowed;
if the file is allowed, then forwarding the last packet to the protected host; and
if the file is determined to be disallowed, then dropping the last packet and terminating the connection.
30. The readable storage medium of claim 29 wherein the analyzing the file comprises performing anti-virus analysis on the file.
31. The readable storage medium of claim 29 further comprising:
analyzing a header of each of the stream of packets; and
if one of the stream of packets is determined to be disallowed, then discarding the disallowed packet and terminating the connection.
32. The readable storage medium of claim 31 wherein analyzing the header comprises inspecting addresses indicated in the header against a packet filter.
33. The readable storage medium of claim 29 further comprising:
individually analyzing each of the copied packet payloads; and
if one of the copied packet payloads is determined to be threatening, then discarding the corresponding packet and terminating the connection.
34. The readable storage medium of claim 33 wherein analyzing each of the copied packet payloads comprises inspecting each copied packet payload against a list of disallowed content and determining if each copied packet payload includes threatening script.
35. The readable storage medium of claim 29 further comprising maintaining the connection while analyzing the file.
36. The readable storage medium of claim 35 wherein maintaining the connection comprises increasing transmission latency of each acknowledgement transmitted from the protected host to the external host until the analysis is complete.
37. A readable storage medium that provides instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:
copying a racket payload of each of a plurality of rackets received on a single connection between an external host and a protected host that carries a stream of packets the stream of packets including the plurality of packets;
forwarding all but the last of the plurality of packets to the protected host;
reassembling the copied packet payloads into a file;
analyzing the file to determine if the file is allowed or disallowed;
maintaining the connection while analyzing the file, wherein maintaining the connection comprises:
decapsulating the last packet's payload,
fragmenting the last packet's payload into subparts,
encapsulating each subpart, and
forwarding each subpart until analysis is complete;
if the file is allowed, then forwarding the last racket to the protected host; and if the file is determined to be disallowed, then dropping the last packet and terminating the connection.
38. A readable storage medium that provides instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:
copying a packet payload of each of a plurality of packets received on a single connection between an external host and a protected host that carries a stream of packets the stream of packets including the plurality of packets;
forwarding all but the last of the plurality of packets to the protected host;
reassembling the copied packet payloads into a file;
analyzing the file to determine if the file is allowed or disallowed;
maintaining the connection while analyzing the file, wherein maintaining the connection comprises:
copying each of the plurality of packets but the last packet before forwarding each of the plurality of packets, and
holding the last packet and repeatedly forwarding the last copied packet;
if the file is allowed, then forwarding the last packet to the protected host; and
if the file is determined to be disallowed, then dropping the last packet and terminating the connection.
39. A readable storage medium that provides instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:
supporting a connection from an external host to a protected host;
analyzing a header of each packet received over the connection from the external host;
terminating the connection if a first packet received over the connection is determined to be disallowed and discarding the first packet;
if the connection is not terminated, copying the first packet's payload;
analyzing the first packet's payload;
terminating the connection if said first packet's payload is determined to be disallowed and discarding the first packet;
if the connection has not been terminated and if said first packet's payload is not a last block of a file, then forwarding said first packet to the protected host;
if said first packet's payload is the last block of a file, then reassembling the first packet's payload with a set of one or more previously copied packet payloads into the file;
analyzing the file to determine if the file is allowed or disallowed;
maintaining the connection while analyzing the file, said maintaining comprising
decapsulating the last packet's payload,
fragmenting the last packet's payload into subparts,
encapsulating each subpart, and
forwarding each subpart until analysis is complete;
if the file is disallowed then dropping the first packet and terminating the connection; and
if the file is allowed then forwarding the first packet.
40. The readable storage medium of claim 39, wherein maintaining the connection comprises increasing transmission latency of each acknowledgement transmitted from the protected host to the external host until the analysis is complete.
41. The readable storage medium of claim 39 wherein the analyzing the file comprises performing anti-virus analysis on the file.
42. The readable storage medium of claim 39 wherein analyzing the header comprises inspecting addresses indicated in the header against a packet filter.
43. The readable storage medium of claim 39 wherein analyzing the first packet's payload comprises inspecting the first packet's payload against a list of disallowed content and determining if the first packet's payload includes threatening script.
44. A readable storage medium that provides instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:
supporting a connection from an external host to a protected host;
analyzing a header of each packet received over the connection from the external host;
terminating the connection if a first racket received over the connection is determined to be disallowed and discarding the first packet;
if the connection is not terminated, copying the first packet's payload;
analyzing the first packet's payload;
terminating the connection if said first packet's payload is determined to be disallowed and discarding the first packet;
if the connection has not been terminated and if said first packet's payload is not a last block of a file, then forwarding said first racket to the protected host;
if said first packet's payload is the last block of a file, then reassembling the first packet's payload with a set of one or more previously copied racket payloads into the file;
analyzing the file to determine if the file is allowed or disallowed;
maintaining the connection while analyzing the file, wherein maintaining the connection comprises:
copying each of the plurality of packets but the last packet before forwarding each of the plurality of packets, and
holding the last packet and repeatedly forwarding the last copied packet;
if the file is disallowed then dropping the first packet and terminating the connection; and
if the file is allowed then forwarding the first packet.
US10/697,846 2003-10-29 2003-10-29 Method and apparatus for datastream analysis and blocking Active 2025-07-03 US7310815B2 (en)

Priority Applications (5)

Application Number Priority Date Filing Date Title
US10/697,846 US7310815B2 (en) 2003-10-29 2003-10-29 Method and apparatus for datastream analysis and blocking
DE602004005396T DE602004005396D1 (en) 2003-10-29 2004-10-27 Method and device for examining and blocking a data stream
AT04025579T ATE357803T1 (en) 2003-10-29 2004-10-27 METHOD AND DEVICE FOR EXAMINING AND BLOCKING A DATA STREAM
EP04025579A EP1528743B1 (en) 2003-10-29 2004-10-27 Method and apparatus for datastream analysis and blocking
TW093133045A TWI378704B (en) 2003-10-29 2004-10-29 Method and apparatus for datastream analysis and blocking

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US10/697,846 US7310815B2 (en) 2003-10-29 2003-10-29 Method and apparatus for datastream analysis and blocking

Publications (2)

Publication Number Publication Date
US20050097358A1 US20050097358A1 (en) 2005-05-05
US7310815B2 true US7310815B2 (en) 2007-12-18

Family

ID=34423402

Family Applications (1)

Application Number Title Priority Date Filing Date
US10/697,846 Active 2025-07-03 US7310815B2 (en) 2003-10-29 2003-10-29 Method and apparatus for datastream analysis and blocking

Country Status (5)

Country Link
US (1) US7310815B2 (en)
EP (1) EP1528743B1 (en)
AT (1) ATE357803T1 (en)
DE (1) DE602004005396D1 (en)
TW (1) TWI378704B (en)

Cited By (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050229237A1 (en) * 2004-04-07 2005-10-13 Fortinet, Inc. Systems and methods for passing network traffic content
US20060023709A1 (en) * 2004-08-02 2006-02-02 Hall Michael L Inline intrusion detection using a single physical port
US20060161983A1 (en) * 2005-01-20 2006-07-20 Cothrell Scott A Inline intrusion detection
US20060224724A1 (en) * 2005-03-31 2006-10-05 Microsoft Corporation Latency free scanning of malware at a network transit point
US20070083922A1 (en) * 2003-11-24 2007-04-12 Richard Reiner Network session re-construction
US20070169184A1 (en) * 2006-01-13 2007-07-19 Fortinet, Inc. Computerized system and method for advanced network content processing
US20080240106A1 (en) * 2007-03-30 2008-10-02 Ralph Schlenk Method and apparatus for MAC address learning
US7562389B1 (en) 2004-07-30 2009-07-14 Cisco Technology, Inc. Method and system for network security
US20120272318A1 (en) * 2011-04-20 2012-10-25 Kaspersky Lab, Zao System and method for dynamic generation of anti-virus databases
US8572267B2 (en) 2001-01-19 2013-10-29 Zvelo, Inc. Managed services platform
US8706570B2 (en) 2002-04-17 2014-04-22 Scott A. Moskowitz Methods, systems and devices for packet watermarking and efficient provisioning of bandwidth
US8712728B2 (en) 2000-09-07 2014-04-29 Blue Spike Llc Method and device for monitoring and analyzing signals
US8782790B1 (en) * 2010-02-19 2014-07-15 Symantec Corporation Signature creation for malicious network traffic
US8930719B2 (en) 1996-01-17 2015-01-06 Scott A. Moskowitz Data protection method and device
US9070151B2 (en) 1996-07-02 2015-06-30 Blue Spike, Inc. Systems, methods and devices for trusted transactions
US9191206B2 (en) 1996-01-17 2015-11-17 Wistaria Trading Ltd Multiple transform utilization and application for secure digital watermarking
US9258116B2 (en) 1996-07-02 2016-02-09 Wistaria Trading Ltd System and methods for permitting open access to data objects and for securing data within the data objects
US9270859B2 (en) 1999-03-24 2016-02-23 Wistaria Trading Ltd Utilizing data reduction in steganographic and cryptographic systems
US9608959B2 (en) * 2015-03-23 2017-03-28 Quest Software Inc. Non RFC-compliant protocol classification based on real use
US9710669B2 (en) 1999-08-04 2017-07-18 Wistaria Trading Ltd Secure personal content server
US9825921B2 (en) 2015-05-26 2017-11-21 Sonicwall Inc. Securing internet of things communications across multiple vendors
US9888011B2 (en) 2015-07-31 2018-02-06 Sonicwall Inc. Social media login and interaction management
US10187446B2 (en) 2015-03-23 2019-01-22 Sonicwall Inc. Firewall multi-level security dynamic host-based sandbox generation for embedded URL links

Families Citing this family (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8270423B2 (en) * 2003-07-29 2012-09-18 Citrix Systems, Inc. Systems and methods of using packet boundaries for reduction in timeout prevention
US8233392B2 (en) * 2003-07-29 2012-07-31 Citrix Systems, Inc. Transaction boundary detection for reduction in timeout penalties
US7630305B2 (en) 2003-07-29 2009-12-08 Orbital Data Corporation TCP selective acknowledgements for communicating delivered and missed data packets
US7616638B2 (en) 2003-07-29 2009-11-10 Orbital Data Corporation Wavefront detection and disambiguation of acknowledgments
US8432800B2 (en) 2003-07-29 2013-04-30 Citrix Systems, Inc. Systems and methods for stochastic-based quality of service
US8437284B2 (en) 2003-07-29 2013-05-07 Citrix Systems, Inc. Systems and methods for additional retransmissions of dropped packets
US8238241B2 (en) 2003-07-29 2012-08-07 Citrix Systems, Inc. Automatic detection and window virtualization for flow control
US7600257B2 (en) 2004-10-13 2009-10-06 Sonicwall, Inc. Method and an apparatus to perform multiple packet payloads analysis
US7835361B1 (en) 2004-10-13 2010-11-16 Sonicwall, Inc. Method and apparatus for identifying data patterns in a file
US20100070982A1 (en) * 2005-09-09 2010-03-18 Pitts William M Distributed File System Consistency Mechanism Extension For Accelerating Communications Between Distributed Applications
GB2432933B (en) * 2006-03-14 2008-07-09 Streamshield Networks Ltd A method and apparatus for providing network security
EP1868321B1 (en) * 2006-06-12 2016-01-20 Mitsubishi Denki Kabushiki Kaisha In-line content analysis of a TCP segment stream
US8392603B2 (en) 2006-08-14 2013-03-05 International Business Machines Corporation File transfer
US8042184B1 (en) 2006-10-18 2011-10-18 Kaspersky Lab, Zao Rapid analysis of data stream for malware presence
US7930750B1 (en) * 2007-04-20 2011-04-19 Symantec Corporation Method to trickle and repair resources scanned using anti-virus technologies on a security gateway
US8166534B2 (en) * 2007-05-18 2012-04-24 Microsoft Corporation Incorporating network connection security levels into firewall rules
US8863286B1 (en) 2007-06-05 2014-10-14 Sonicwall, Inc. Notification for reassembly-free file scanning
US8416773B2 (en) * 2007-07-11 2013-04-09 Hewlett-Packard Development Company, L.P. Packet monitoring
US7991723B1 (en) 2007-07-16 2011-08-02 Sonicwall, Inc. Data pattern analysis using optimized deterministic finite automaton
US8813221B1 (en) 2008-09-25 2014-08-19 Sonicwall, Inc. Reassembly-free deep packet inspection on multi-core hardware
TW201029396A (en) * 2009-01-21 2010-08-01 Univ Nat Taiwan Packet processing device and method
US9769149B1 (en) 2009-07-02 2017-09-19 Sonicwall Inc. Proxy-less secure sockets layer (SSL) data inspection
WO2011058261A1 (en) * 2009-11-13 2011-05-19 France Telecom Method for scanning content sent by packets in a communication network to a terminal, computer program, network device and system
US10834065B1 (en) 2015-03-31 2020-11-10 F5 Networks, Inc. Methods for SSL protected NTLM re-authentication and devices thereof
US10404698B1 (en) 2016-01-15 2019-09-03 F5 Networks, Inc. Methods for adaptive organization of web application access points in webtops and devices thereof
US20200136966A1 (en) * 2018-10-31 2020-04-30 Vmware, Inc. Multitenancy for service machines
TWI825293B (en) * 2020-03-24 2023-12-11 瑞昱半導體股份有限公司 Circuitry within network device
CN113872936A (en) * 2021-08-26 2021-12-31 上海宝康电子控制工程有限公司 Stream mode network security detection method and system

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1997039399A2 (en) 1996-03-29 1997-10-23 Trend Micro, Incorporated Apparatus and method for electronic mail virus detection and elimination
US6088803A (en) * 1997-12-30 2000-07-11 Intel Corporation System for virus-checking network data during download to a client device
US6119236A (en) * 1996-10-07 2000-09-12 Shipley; Peter M. Intelligent network security device and method
US6178448B1 (en) * 1997-06-18 2001-01-23 International Business Machines Corporation Optimal link scheduling for multiple links by obtaining and utilizing link quality information
US6219706B1 (en) * 1998-10-16 2001-04-17 Cisco Technology, Inc. Access control for networks
EP1122932A2 (en) 2000-02-04 2001-08-08 Aladdin Knowledge Systems Ltd. Protection of computer networks against malicious content
US6449723B1 (en) * 1997-03-10 2002-09-10 Computer Associates Think, Inc. Method and system for preventing the downloading and execution of executable objects
US20030145228A1 (en) 2002-01-31 2003-07-31 Janne Suuronen System and method of providing virus protection at a gateway
US20040093513A1 (en) * 2002-11-07 2004-05-13 Tippingpoint Technologies, Inc. Active network defense system and method

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1997039399A2 (en) 1996-03-29 1997-10-23 Trend Micro, Incorporated Apparatus and method for electronic mail virus detection and elimination
US6119236A (en) * 1996-10-07 2000-09-12 Shipley; Peter M. Intelligent network security device and method
US6449723B1 (en) * 1997-03-10 2002-09-10 Computer Associates Think, Inc. Method and system for preventing the downloading and execution of executable objects
US6178448B1 (en) * 1997-06-18 2001-01-23 International Business Machines Corporation Optimal link scheduling for multiple links by obtaining and utilizing link quality information
US6088803A (en) * 1997-12-30 2000-07-11 Intel Corporation System for virus-checking network data during download to a client device
US6219706B1 (en) * 1998-10-16 2001-04-17 Cisco Technology, Inc. Access control for networks
EP1122932A2 (en) 2000-02-04 2001-08-08 Aladdin Knowledge Systems Ltd. Protection of computer networks against malicious content
US20030145228A1 (en) 2002-01-31 2003-07-31 Janne Suuronen System and method of providing virus protection at a gateway
US20040093513A1 (en) * 2002-11-07 2004-05-13 Tippingpoint Technologies, Inc. Active network defense system and method

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
European Search Report, Application No. EP 04 02 5579, May 23, 2005.
Firewall-Friendly FTP, Network Working Group, S. Bellovin, AT&T Bell Laboratories, Feb. 1994 (4 pp) dated Jul. 15, 2002.
Snort Users Manual, Snort Release 2.0.0, M. Roesch, C. Green, Copyright 1998-2003 M. Roesch, Copyright 2001-2003 C. Green, Copyright 2003 Sourcefire, Inc. dated Dec. 8, 2003 (53 pgs).
The Ultimate Internet Sharing Solution, WinProxy, User Manual, Copyright 1996-2002 Osistis Software, Inc., dated Feb. 2002 (290 pgs).

Cited By (60)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9191205B2 (en) 1996-01-17 2015-11-17 Wistaria Trading Ltd Multiple transform utilization and application for secure digital watermarking
US9021602B2 (en) 1996-01-17 2015-04-28 Scott A. Moskowitz Data protection method and device
US9104842B2 (en) 1996-01-17 2015-08-11 Scott A. Moskowitz Data protection method and device
US9171136B2 (en) 1996-01-17 2015-10-27 Wistaria Trading Ltd Data protection method and device
US9191206B2 (en) 1996-01-17 2015-11-17 Wistaria Trading Ltd Multiple transform utilization and application for secure digital watermarking
US8930719B2 (en) 1996-01-17 2015-01-06 Scott A. Moskowitz Data protection method and device
US9070151B2 (en) 1996-07-02 2015-06-30 Blue Spike, Inc. Systems, methods and devices for trusted transactions
US9843445B2 (en) 1996-07-02 2017-12-12 Wistaria Trading Ltd System and methods for permitting open access to data objects and for securing data within the data objects
US9830600B2 (en) 1996-07-02 2017-11-28 Wistaria Trading Ltd Systems, methods and devices for trusted transactions
US9258116B2 (en) 1996-07-02 2016-02-09 Wistaria Trading Ltd System and methods for permitting open access to data objects and for securing data within the data objects
US9270859B2 (en) 1999-03-24 2016-02-23 Wistaria Trading Ltd Utilizing data reduction in steganographic and cryptographic systems
US10461930B2 (en) 1999-03-24 2019-10-29 Wistaria Trading Ltd Utilizing data reduction in steganographic and cryptographic systems
US9710669B2 (en) 1999-08-04 2017-07-18 Wistaria Trading Ltd Secure personal content server
US9934408B2 (en) 1999-08-04 2018-04-03 Wistaria Trading Ltd Secure personal content server
US10110379B2 (en) 1999-12-07 2018-10-23 Wistaria Trading Ltd System and methods for permitting open access to data objects and for securing data within the data objects
US10644884B2 (en) 1999-12-07 2020-05-05 Wistaria Trading Ltd System and methods for permitting open access to data objects and for securing data within the data objects
US8712728B2 (en) 2000-09-07 2014-04-29 Blue Spike Llc Method and device for monitoring and analyzing signals
US8572267B2 (en) 2001-01-19 2013-10-29 Zvelo, Inc. Managed services platform
US8977762B2 (en) 2001-01-19 2015-03-10 Zvelo, Inc. Managed services platform
US8706570B2 (en) 2002-04-17 2014-04-22 Scott A. Moskowitz Methods, systems and devices for packet watermarking and efficient provisioning of bandwidth
US10735437B2 (en) 2002-04-17 2020-08-04 Wistaria Trading Ltd Methods, systems and devices for packet watermarking and efficient provisioning of bandwidth
US9639717B2 (en) 2002-04-17 2017-05-02 Wistaria Trading Ltd Methods, systems and devices for packet watermarking and efficient provisioning of bandwidth
US20070083922A1 (en) * 2003-11-24 2007-04-12 Richard Reiner Network session re-construction
US9191412B2 (en) * 2004-04-07 2015-11-17 Fortinct, Inc. Systems and methods for passing network traffic content
US20140366088A1 (en) * 2004-04-07 2014-12-11 Fortinet, Inc. Systems and methods for passing network traffic content
US10069794B2 (en) * 2004-04-07 2018-09-04 Fortinet, Inc. Systems and methods for passing network traffic content
US8863277B2 (en) * 2004-04-07 2014-10-14 Fortinet, Inc. Systems and methods for passing network traffic content
US20050229237A1 (en) * 2004-04-07 2005-10-13 Fortinet, Inc. Systems and methods for passing network traffic content
US20170187680A1 (en) * 2004-04-07 2017-06-29 Fortinet, Inc. Systems and methods for passing network traffic content
US9537826B2 (en) 2004-04-07 2017-01-03 Fortinet, Inc. Systems and methods for passing network traffic content
US7562389B1 (en) 2004-07-30 2009-07-14 Cisco Technology, Inc. Method and system for network security
US7555774B2 (en) 2004-08-02 2009-06-30 Cisco Technology, Inc. Inline intrusion detection using a single physical port
US20060023709A1 (en) * 2004-08-02 2006-02-02 Hall Michael L Inline intrusion detection using a single physical port
US20060161983A1 (en) * 2005-01-20 2006-07-20 Cothrell Scott A Inline intrusion detection
US20100226383A1 (en) * 2005-01-20 2010-09-09 Cisco Technology, Inc. Inline Intrusion Detection
US9009830B2 (en) * 2005-01-20 2015-04-14 Cisco Technology, Inc. Inline intrusion detection
US7725938B2 (en) * 2005-01-20 2010-05-25 Cisco Technology, Inc. Inline intrusion detection
US7844700B2 (en) * 2005-03-31 2010-11-30 Microsoft Corporation Latency free scanning of malware at a network transit point
US20060224724A1 (en) * 2005-03-31 2006-10-05 Microsoft Corporation Latency free scanning of malware at a network transit point
US8925065B2 (en) 2006-01-13 2014-12-30 Fortinet, Inc. Computerized system and method for advanced network content processing
US8468589B2 (en) * 2006-01-13 2013-06-18 Fortinet, Inc. Computerized system and method for advanced network content processing
US9825993B2 (en) 2006-01-13 2017-11-21 Fortinet, Inc. Computerized system and method for advanced network content processing
US20070169184A1 (en) * 2006-01-13 2007-07-19 Fortinet, Inc. Computerized system and method for advanced network content processing
US10009386B2 (en) 2006-01-13 2018-06-26 Fortinet, Inc. Computerized system and method for advanced network content processing
US9253155B2 (en) 2006-01-13 2016-02-02 Fortinet, Inc. Computerized system and method for advanced network content processing
US20080240106A1 (en) * 2007-03-30 2008-10-02 Ralph Schlenk Method and apparatus for MAC address learning
US8295282B2 (en) * 2007-03-30 2012-10-23 Alcatel Lucent Method and apparatus for MAC address learning
US8782790B1 (en) * 2010-02-19 2014-07-15 Symantec Corporation Signature creation for malicious network traffic
US20120272318A1 (en) * 2011-04-20 2012-10-25 Kaspersky Lab, Zao System and method for dynamic generation of anti-virus databases
US8776234B2 (en) * 2011-04-20 2014-07-08 Kaspersky Lab, Zao System and method for dynamic generation of anti-virus databases
US10187446B2 (en) 2015-03-23 2019-01-22 Sonicwall Inc. Firewall multi-level security dynamic host-based sandbox generation for embedded URL links
US10225235B2 (en) 2015-03-23 2019-03-05 Sonicwall Inc. Non RFC-compliant protocol classification based on real use
US9838357B2 (en) 2015-03-23 2017-12-05 Sonicwall Inc. Non RFC-compliant protocol classification based on real use
US9608959B2 (en) * 2015-03-23 2017-03-28 Quest Software Inc. Non RFC-compliant protocol classification based on real use
US11303693B2 (en) 2015-03-23 2022-04-12 Sonicwall Inc. Firewall multi-level security dynamic host-based sandbox generation for embedded URL links
US11671477B2 (en) 2015-03-23 2023-06-06 Sonicwall Inc. Firewall multi-level security dynamic host-based sandbox generation for embedded URL links
US10110571B2 (en) 2015-05-26 2018-10-23 Sonicwall Inc. Securing internet of things communications across multiple vendors
US9825921B2 (en) 2015-05-26 2017-11-21 Sonicwall Inc. Securing internet of things communications across multiple vendors
US10057271B2 (en) 2015-07-31 2018-08-21 Sonicwall Inc. Social media login and interaction management
US9888011B2 (en) 2015-07-31 2018-02-06 Sonicwall Inc. Social media login and interaction management

Also Published As

Publication number Publication date
TW200531500A (en) 2005-09-16
EP1528743B1 (en) 2007-03-21
EP1528743A3 (en) 2005-07-06
US20050097358A1 (en) 2005-05-05
EP1528743A2 (en) 2005-05-04
ATE357803T1 (en) 2007-04-15
DE602004005396D1 (en) 2007-05-03
TWI378704B (en) 2012-12-01

Similar Documents

Publication Publication Date Title
US7310815B2 (en) Method and apparatus for datastream analysis and blocking
US7461403B1 (en) System and method for providing passive screening of transient messages in a distributed computing environment
KR101280910B1 (en) Two-stage intrusion detection system for high speed packet process using network processor and method thereof
JP5394482B2 (en) Packet fragment processing
Handley et al. Network Intrusion Detection: Evasion, Traffic Normalization, and {End-to-End} Protocol Semantics
US9392002B2 (en) System and method of providing virus protection at a gateway
US7391770B1 (en) Network access control system and method using adaptive proxies
US20070025374A1 (en) TCP normalization engine
US7535907B2 (en) TCP engine
US8799504B2 (en) System and method of TCP tunneling
US7117533B1 (en) System and method for providing dynamic screening of transient messages in a distributed computing environment
US20060268866A1 (en) Out-of-order superscalar IP packet analysis
JP2005529523A (en) Gigabit Ethernet adapter supporting ISCSI and IPSEC protocols
WO2004057445A2 (en) Method and apparatus for resource locator identifier rewrite
JP2009510815A (en) Method and system for reassembling packets before search
JP4875126B2 (en) Gigabit Ethernet adapter supporting ISCSI and IPSEC protocols
JP2007538444A (en) Firewall system
Daniels et al. Identification of host audit data to detect attacks on low-level IP vulnerabilities
CN108737413B (en) Data processing method and device of transmission layer and computer readable storage medium
CN104348785B (en) The method, apparatus and system for preventing host PMTU from attacking in IPv6 nets
Mahdavi et al. RFC2498: IPPM Metrics for Measuring Connectivity
Niemi et al. Evading deep inspection for fun and shell
WO2003014932A2 (en) System and method for providing passive screening of transient messages in a distributed computing environment
CN114567484B (en) Message processing method and device, electronic equipment and storage medium
Bernardo et al. Network security considerations for a new generation protocol UDT

Legal Events

Date Code Title Description
AS Assignment

Owner name: MICRON TECHNOLOGY, INC., IDAHO

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:RUDECK, PAUL J.;POWELL, DON C.;REEL/FRAME:014233/0309;SIGNING DATES FROM 20031024 TO 20031028

AS Assignment

Owner name: SONICWALL, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:YANOVSKY, BORIS;REEL/FRAME:014659/0900

Effective date: 20031028

STCF Information on status: patent grant

Free format text: PATENTED CASE

AS Assignment

Owner name: PSM MERGER SUB (DELAWARE), INC., CALIFORNIA

Free format text: MERGER;ASSIGNOR:SONICWALL, INC.;REEL/FRAME:024755/0083

Effective date: 20100723

Owner name: SONICWALL, INC., CALIFORNIA

Free format text: CHANGE OF NAME;ASSIGNOR:PSM MERGER SUB (DELAWARE), INC.;REEL/FRAME:024755/0091

Effective date: 20100723

AS Assignment

Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, NEW YORK

Free format text: PATENT SECURITY AGREEMENT (SECOND LIEN);ASSIGNORS:AVENTAIL LLC;SONICWALL, INC.;REEL/FRAME:024823/0280

Effective date: 20100723

Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, NEW YORK

Free format text: SECURITY AGREEMENT;ASSIGNORS:AVENTAIL LLC;SONICWALL, INC.;REEL/FRAME:024776/0337

Effective date: 20100723

FPAY Fee payment

Year of fee payment: 4

AS Assignment

Owner name: SONICWALL, INC., CALIFORNIA

Free format text: RELEASE OF SECURITY INTEREST IN PATENTS RECORDED ON REEL/FRAME 024823/0280;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:028177/0126

Effective date: 20120508

Owner name: SONICWALL, INC., CALIFORNIA

Free format text: RELEASE OF SECURITY INTEREST IN PATENTS RECORDED ON REEL/FRAME 024776/0337;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:028177/0115

Effective date: 20120508

Owner name: AVENTAIL LLC, CALIFORNIA

Free format text: RELEASE OF SECURITY INTEREST IN PATENTS RECORDED ON REEL/FRAME 024823/0280;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:028177/0126

Effective date: 20120508

Owner name: AVENTAIL LLC, CALIFORNIA

Free format text: RELEASE OF SECURITY INTEREST IN PATENTS RECORDED ON REEL/FRAME 024776/0337;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:028177/0115

Effective date: 20120508

FPAY Fee payment

Year of fee payment: 8

AS Assignment

Owner name: DELL SOFTWARE INC., TEXAS

Free format text: MERGER;ASSIGNOR:SONICWALL L.L.C.;REEL/FRAME:037291/0717

Effective date: 20150408

Owner name: SONICWALL L.L.C., DELAWARE

Free format text: CONVERSION AND NAME CHANGE;ASSIGNOR:SONICWALL, INC.;REEL/FRAME:037292/0564

Effective date: 20130123

AS Assignment

Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT, NORTH CAROLINA

Free format text: SECURITY AGREEMENT;ASSIGNORS:AVENTAIL LLC;DELL PRODUCTS, L.P.;DELL SOFTWARE INC.;REEL/FRAME:040030/0187

Effective date: 20160907

Owner name: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT, TEXAS

Free format text: SECURITY AGREEMENT;ASSIGNORS:AVENTAIL LLC;DELL PRODUCTS L.P.;DELL SOFTWARE INC.;REEL/FRAME:040039/0642

Effective date: 20160907

Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLAT

Free format text: SECURITY AGREEMENT;ASSIGNORS:AVENTAIL LLC;DELL PRODUCTS, L.P.;DELL SOFTWARE INC.;REEL/FRAME:040030/0187

Effective date: 20160907

Owner name: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., A

Free format text: SECURITY AGREEMENT;ASSIGNORS:AVENTAIL LLC;DELL PRODUCTS L.P.;DELL SOFTWARE INC.;REEL/FRAME:040039/0642

Effective date: 20160907

AS Assignment

Owner name: DELL SOFTWARE INC., CALIFORNIA

Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:040521/0467

Effective date: 20161031

Owner name: DELL PRODUCTS L.P., TEXAS

Free format text: RELEASE OF SECURITY INTEREST IN CERTAIN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (040039/0642);ASSIGNOR:THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A.;REEL/FRAME:040521/0016

Effective date: 20161031

Owner name: AVENTAIL LLC, CALIFORNIA

Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:040521/0467

Effective date: 20161031

Owner name: DELL SOFTWARE INC., CALIFORNIA

Free format text: RELEASE OF SECURITY INTEREST IN CERTAIN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (040039/0642);ASSIGNOR:THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A.;REEL/FRAME:040521/0016

Effective date: 20161031

Owner name: DELL PRODUCTS, L.P., TEXAS

Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:040521/0467

Effective date: 20161031

Owner name: AVENTAIL LLC, CALIFORNIA

Free format text: RELEASE OF SECURITY INTEREST IN CERTAIN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (040039/0642);ASSIGNOR:THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A.;REEL/FRAME:040521/0016

Effective date: 20161031

AS Assignment

Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT, NEW YORK

Free format text: FIRST LIEN PATENT SECURITY AGREEMENT;ASSIGNOR:DELL SOFTWARE INC.;REEL/FRAME:040581/0850

Effective date: 20161031

Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLAT

Free format text: FIRST LIEN PATENT SECURITY AGREEMENT;ASSIGNOR:DELL SOFTWARE INC.;REEL/FRAME:040581/0850

Effective date: 20161031

AS Assignment

Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT, NEW YORK

Free format text: SECOND LIEN PATENT SECURITY AGREEMENT;ASSIGNOR:DELL SOFTWARE INC.;REEL/FRAME:040587/0624

Effective date: 20161031

Owner name: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLAT

Free format text: SECOND LIEN PATENT SECURITY AGREEMENT;ASSIGNOR:DELL SOFTWARE INC.;REEL/FRAME:040587/0624

Effective date: 20161031

AS Assignment

Owner name: SONICWALL US HOLDINGS, INC., CALIFORNIA

Free format text: INTELLECTUAL PROPERTY SECURITY AGREEMENT;ASSIGNOR:QUEST SOFTWARE INC.;REEL/FRAME:041073/0001

Effective date: 20161230

AS Assignment

Owner name: SONICWALL US HOLDINGS INC., CALIFORNIA

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE THE NATURE OF CONVEYANCE PREVIOUSLY RECORDED AT REEL: 041073 FRAME: 0001. ASSIGNOR(S) HEREBY CONFIRMS THE INTELLECTUAL PROPERTY ASSIGNMENT.;ASSIGNOR:QUEST SOFTWARE INC.;REEL/FRAME:042168/0114

Effective date: 20161230

AS Assignment

Owner name: QUEST SOFTWARE INC. (F/K/A DELL SOFTWARE INC.), CALIFORNIA

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNEE PREVIOUSLY RECORDED AT REEL: 040587 FRAME: 0624. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:044811/0598

Effective date: 20171114

Owner name: AVENTAIL LLC, CALIFORNIA

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNEE PREVIOUSLY RECORDED AT REEL: 040587 FRAME: 0624. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:044811/0598

Effective date: 20171114

Owner name: QUEST SOFTWARE INC. (F/K/A DELL SOFTWARE INC.), CA

Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNEE PREVIOUSLY RECORDED AT REEL: 040587 FRAME: 0624. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH;REEL/FRAME:044811/0598

Effective date: 20171114

AS Assignment

Owner name: QUEST SOFTWARE INC., DELAWARE

Free format text: CHANGE OF NAME;ASSIGNOR:DELL SOFTWARE INC.;REEL/FRAME:046040/0277

Effective date: 20161101

AS Assignment

Owner name: QUEST SOFTWARE INC. (F/K/A DELL SOFTWARE INC.), CALIFORNIA

Free format text: RELEASE OF FIRST LIEN SECURITY INTEREST IN PATENTS RECORDED AT R/F 040581/0850;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT;REEL/FRAME:046211/0735

Effective date: 20180518

Owner name: AVENTAIL LLC, CALIFORNIA

Free format text: RELEASE OF FIRST LIEN SECURITY INTEREST IN PATENTS RECORDED AT R/F 040581/0850;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT;REEL/FRAME:046211/0735

Effective date: 20180518

Owner name: QUEST SOFTWARE INC. (F/K/A DELL SOFTWARE INC.), CA

Free format text: RELEASE OF FIRST LIEN SECURITY INTEREST IN PATENTS RECORDED AT R/F 040581/0850;ASSIGNOR:CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT;REEL/FRAME:046211/0735

Effective date: 20180518

AS Assignment

Owner name: UBS AG, STAMFORD BRANCH, AS COLLATERAL AGENT, CONNECTICUT

Free format text: FIRST LIEN PATENT SECURITY AGREEMENT;ASSIGNOR:SONICWALL US HOLDINGS INC.;REEL/FRAME:046321/0414

Effective date: 20180518

Owner name: UBS AG, STAMFORD BRANCH, AS COLLATERAL AGENT, CONNECTICUT

Free format text: SECOND LIEN PATENT SECURITY AGREEMENT;ASSIGNOR:SONICWALL US HOLDINGS INC.;REEL/FRAME:046321/0393

Effective date: 20180518

Owner name: UBS AG, STAMFORD BRANCH, AS COLLATERAL AGENT, CONN

Free format text: SECOND LIEN PATENT SECURITY AGREEMENT;ASSIGNOR:SONICWALL US HOLDINGS INC.;REEL/FRAME:046321/0393

Effective date: 20180518

Owner name: UBS AG, STAMFORD BRANCH, AS COLLATERAL AGENT, CONN

Free format text: FIRST LIEN PATENT SECURITY AGREEMENT;ASSIGNOR:SONICWALL US HOLDINGS INC.;REEL/FRAME:046321/0414

Effective date: 20180518

FEPP Fee payment procedure

Free format text: MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FEPP Fee payment procedure

Free format text: 11.5 YR SURCHARGE- LATE PMT W/IN 6 MO, LARGE ENTITY (ORIGINAL EVENT CODE: M1556); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 12